In case anyone else wants to configure third-party equipment for a TPG fibre-to-the-building service, here are the details. Below the fold are screenshots of the settings entered in the web-based configuration UI of an AVM FRITZ!Box. Note that the SIP password is not the same as your account password, and you’ll need to obtain this somehow. TPG doesn’t make this easy, but it is possible.

Due to persistent issues with line quality, I switched an Internet connection from Internode ADSL2+ to TPG fibre to the building (FTTB). Although the connection quality is better, just about everything else about TPG is worse. I strongly recommend avoiding TPG. Problems include:

Error-prone signup process

Supplied modem/router is heavily compromised

Phone service is tied to compromised modem/router

No IPv6 support

Support staff very inconsistent

Good support staff hobbled by policy

My Internode connection had become very slow and unstable in hot, dry weather. Strangely it was fine in the rain, and even during flooding. It almost seemed like something needed to be damp to maintain an electrical connection. There’s no way to actually get these kinds of issues resolved, as the ISP and last mile provider will blame each other and the in-building wiring, and charge extortionate rates for technicians to be called out without actually solving the issues. The only other option I have for last mile is TPG. I’d been switching to Telstra LTE on bad days, and to be fair it’s actually not too bad at the moment. It seems to be pretty fast and stable, but I imagine that will get worse as more people start to use the network. But using LTE comes with a number of imitations, and it’s supposed to be my backup, not my day-to-day Internet connection.

Sadly, it seems that Internode may be going downhill since being acquired by TPG. After iiNet acquired Internode, they were allowed to operate independently for the most part. The call centre in Adelaide remained open, Internode continued to offer the same kinds of perks as before, including Usenet servers, Steam content mirrors, native IPv6 connectivity, and more. However, TPG has consolidated iiNet and Internode support and seems to be phasing out Internode perks. They’ve even started selling TPG nbn™ HFC (DOCSIS cable) under the Internode brand name, providing the same IPv4-only connection and obfuscated SIP phone service.

With the consolidation in the Australian ISP sector, there’s a big reduction in competition. TPG has merged with or acquired Soul, AAPT, Chariot, iiNet, Internode, TransACT, WestNet, PIPE, Westnet, and more. There doesn’t seem to be a good alternative at the moment. There may be an opportunity for an upstart ISP that understands what made “premium” ISPs like Internode successful in the first place.

For lulz, I decided to rewrite MAME’s Intel 4004 CPU core and add support for most 4040 features. The new CPU core operates at the bus cycle level, and exposes most useful signals. It also uses lots of address spaces for all the different kinds of memory and I/O it supports (thanks OG). Some CPU core bugs were fixed along the way – notably intra-page jumps on page boundaries were broken.

One nice benefit we get from this is being able to hook up the I/O for the Bally/Nutting solid-state Flicker pinball prototype (supposedly the first microprocessor-controlled pinball machine) how the hardware actually worked. I also hooked up the playfield lamp matrix as outputs and the operator adjustments as machine configuration while I was at it. We need a proper thermal model of a lamp with PWM dimming support before that part can be declared perfect. (It previously used a hack, pulling the low bits of RC out of the CPU using the state interface. This worked due to a quirk of the game program, and there was no way to implement it properly without the 4004 CM-RAM signals being exposed.)

Possibly more interestingly, we can now emulate the Intel INTELLEC® 4/MOD 40 development system. There seem to be very few surviving examples of this system, but fortunately we’ve got monitor PROM dumps, and there’s some information floating around the web. It has interesting debugging features on the front panel. There’s a scanned manual, but the schematics are very poor quality. However, with some idea of how it works, it’s possible to work out what all the chips are supposed to be. That’s the fun part. Turning it into MAME code isn’t as much fun, but it’s doable.

The front panel looks like this:

That requires clickable artwork for the switches and outputs for the LEDs to get a usable experience (writing the MAME XML layout really isn’t fun). There’s a simple monitor in PROM, designed to be used with an ASCII teleprinter with paper tape reader and punch (e.g. a Teletype Model 33 ASR). MAME’s RS-232 video terminal will have to do as a substitute for that.

If you get bleeding edge MAME (i.e. built from source no more than a day or so old), you can try it out in emulation. Did you ever wonder how developers may have debugged 4004 code in the mid to late ’70s? Well even if you didn’t, now you can find out.

The front panel looks like this in emulation (without the explanatory labels), and by default MAME shows the video terminal below this:

All those LEDs are functional, and all those switches are clickable and visually reflect their current state.

So how would you actually use it in practice? That’s where this brief instruction manual on the MAMEdev wiki comes in. It’s complete with examples of how some of the monitor commands and front panel debugging features can be used. It’s marked NOT_WORKING in MAME for now because you need to manually set up the terminal the first time you use it, and I haven’t finished implementing the universal slots and storage cards. But you can do all the things described on that page.

Does anyone care? Probably not. Will anyone actually even try this system out in MAME? Probably not (apart from Robbbbbbbert). But this is another example of something that you can only do in MAME, and how completely unrelated systems can both benefit from emulating the same chip properly. It also gets rid of one previously unavoidable hack, and gets us one step closer to feature parity with EmuAllSystems.

ShouTime dumped the incredibly rare game Omega (Nihon System). It’s a ball-and-paddle game running on similar hardware to Sega’s Gigas. These games use an NEC MC-8123 CPU module containing a Z80 core, decryption circuitry, and an 8 KiB encryption key in battery-backed RAM. When fetching a byte from ROM or RAM, the CPU chooses a byte from the encryption key based on twelve of the address bits and whether it’s an M1 (opcode fetch) cycle or not. This byte from the encryption key controls what permutation (if any) is applied to the byte the CPU fetches. This encryption scheme could have been brutal, requiring extensive analysis of a working CPU module to crack, if it weren’t for a fatal flaw: Sega used a simple linear congruential generator algorithm to create 8 KiB keys from 24-bit seeds. That means there are less than seventeen million encryption keys to test. Seventeen million might sound like a lot, but it’s far less than the total possible number of keys, and definitely small enough to apply a known plaintext attack in a reasonable amount of time.

So how do we go about attacking it? First we have to make an assumption about what the game program is going to be doing. Given that the hardware looks pretty similar to Gigas and Free Kick, I guessed that one of the first things the program would do is write a zero somewhere to disable the non-maskable interrupt generator disable maskable interrupts. So I wrote a program to find candidate seeds (no, I won’t show you the source code for this program – it’s embarrassingly ugly and hacky, not something I could ever be proud of):

Start with first possible 24-bit seed value

Generate 8 KiB key using algorithm known to be used by Sega

Decrypt first few bytes of program ROM using this key

If it looks like Z80 code to store zero somewhere and disable interrupts, log the seed

Repeat for next possible seed value until we run out of values to try

This ran in just a few minutes on an i7 notebook, and narrowed down the millions of possible seed values to just five candidates: 36DF3D, 6F45E0, 7909D0, 861226, and BE78C9 (in hexadecimal notation). Now I could have tried these in order, but it looked like Sega had made another misstep: besides using a predictable algorithm to generate the key, they also used a predictable seed value to feed this algorithm. The candidate seeds value 861226 looks like a date in year-month-day format. It turns out this seed generates the correct key to decrypt the game program, so I guess we know what someone at Sega was doing the day after Christmas in 1986.

Brian Troha hooked up the peripheral emulation, and the game will be playable in MAME 0.183 (due for release on 22 February). Colours aren’t quite right as we don’t have dumps of the palette PROMs yet, but we expect to resolve this in a future release. Thanks to ShouTime and everyone else involved in preserving this very rare piece of arcade history.

Back in the distant past, MAME started cataloguing programmable logic devices (PLDs) in addition to ROMs. This was met with considerable hostility from certain segments of the community, as it was seen as forcing them to obtain files they saw as unnecessary for emulation in order to run their precious games. However PLDs are programmable devices, and it’s important to preserve them. So far though, the PLD dumps have mainly been used by PCB owners looking to repair their games. The haven’t been used by MAME for emulation. However, PLDs are key to the operation of many arcade games, performing functions like address decoding and video mixing.

One such arcade board is Zaccaria’s Laser Battle, also released under license by Midway as Lazarian. This board uses complex video circuitry that was poorly understood. It includes:

TTL logic for generating two symmetrical area effects, or one area effect and one point effect

On top of this, they decided it was a good idea to use some clever logic to divide the master clock by four when feeding the Signetics S2621 Universal Sync Generator (USG) that generates video timings, but to divide it by three to generate the pixel clock feeding the rest of the video hardware. This lets them get one third more horizontal resolution than the Signetics chips are designed to work with. They need additional logic to line up the pixel clock with the end of horizontal blanking, because the number of pixels in a line isn’t divisible by three, and some more logic for delaying the start of the visible portion of each frame and cutting it off early because they wanted less vertical resolution than the Signetics chips are designed for. It uses an GRBGRBGR colour scheme where the most significant bits are are in the middle of the byte and the missing least significant blue bit effectively always, so it can’t produce black, only a dark blue Was this design effort worth it? I guess they must’ve made some money off the Midway license at least.

Anyway, this game has never worked properly in MAME. It’s always been missing the area and point effects, the colours have always been completely wrong, and the mixing between layers hasn’t properly either. And that’s done inside the PLA. The PLA has 48 internal logic variables, each of which can be programmed to recognise an arbitrary combination of levels on the 16 input line. Each of the internal variables can drive any combination of the eight output lines. The outputs can be configured to be inverting or non-inverting.

In theory this sounds like a job for a ROM, so why use a PLA instead? Well a ROM with 16 input bits and eight output bits would need 64kB of space. Such a ROM would likely have been prohibitively expensive when this game was produced. I mean, its program ROMs are only 2kB each, so there’s no way they’d be sourcing a ROM 32 times that size just for video mixing. The PLA maps the same number of inputs to the same number of outputs with just 1,928 bit of storage, or a little less than one of the program ROMs. It can’t produce absolutely any arbitrary input to output mapping, but it’s more than enough for this application. In fact, it turns out they didn’t even need to use all the space in the PLA.

Read the rest of the post if you want to know more about the process of decoding the PLA bitstream and examining its contents.

It’s not secret I don’t like the way the web is succumbing to JavaScript bloat and sucking in scripts from third-party sites. But I now have another reason to hate it. A few sites are blocked from China, including most Google properties such as Google search, Google APIs and YouTube (and also Tagged, incidentally). If a site that isn’t blocked from China tries to load scripts from Google APIs, for example the minified jQuery script, I have to wait for the blocked request to time out before the page will display at all, and functionality may be broken if the page actually depends on jQuery for content display or navigation. Is it really that hard to host your own scripts? Do you really need to give Google even more data on our browsing habits? One good thing about China’s policies it they make it harder for fucking Google to track us over here.

The newspapers just love publishing stories about prostitution, because they know it sells. Amanda Goff aka Samantha X has been giving them plenty of fuel. Of course these stories all have comments left open, and it’s only a matter of time before a certain argument comes up in one form or another. Here’s an example of it, as found in a comment on a Fairfax newspaper site:

My argument against prostitution isn’t based on religion, conservative values or prudishness, but is more to do with the fact that, in essence, prostitutes are being bribed to have sex with someone they don’t actually want to have sex with. One wants sex and the other doesn’t. Some may protest that they do want the sex, but what if no money was involved? That’s right. The sex wouldn’t happen.

This “argument” is absolutely absurd. Do the people making it really not see the glaring flaw? How about we do a simple substitution:

My argument against garbage collection isn’t based on religion, conservative values or prudishness, but is more to do with the fact that, in essence, garbage collectors are being bribed to collect garbage they don’t actually want to collect. One wants garbage collected and the other doesn’t. Some may protest that they do want to collect garbage, but what if no money was involved? That’s right. The garbage wouldn’t be collected.

You can apply it to most occupations. If no money was involved, the roads wouldn’t be maintained, the supermarket shelves wouldn’t be stacked, the garbage wouldn’t be collected, nothing would be manufactured, and society as we know it wouldn’t exist. I’m not trying to make a case for or against prostitution, I’m just completely sick of seeing this absolutely stupid argument smugly parroted over and over again.

Melbourne on new year’s day is a weird place. All sorts of shops, restaurants and bars are were closed. The entire Royal Arcade was closed for some reason. It’s like Melbourne still wants to believe it’s a quiet country town. Despite the crappy weather, there was plenty of foot traffic in the CBD, so a lot of the places that had the sense to stay open seemed to be doing pretty well. Fortunately the prices are high enough at Passionflower that it wasn’t overcrowded, and we could easily get a table to enjoy some very overpriced, sugar-laden dessert. The Melbourne one (Bourke St) has friendlier staff, better service and gets the nicer presentation of the food than the one at Capitol Square in Sydney — the staff there act like customers are an unwanted nuisance.

Anyway, with my parents in town, my wife and I decided to take advantage of the possibility of free babysitting and go out for dinner. There were limited options, but most of the restaurants in the Crown complex at Southbank were open, so we ended up at Nobu. It’s immediately obvious that the floor staff don’t really speak Japanese. It makes no sense to (poorly) attempt to say “irasshaimase” as you show someone to their table; you should have said that as they approached the door, or the moment they walked in. (Something like “kochira e” works when showing a person to their table.) All the staff were doing this with everyone, which kept my wife giggling. I guess they could claim to provide free entertainment. You might get even more entertainment if you get a seat in the upper bar/lounge area with a view of the riverbank. For example we saw some really weird cougar thing going on. There was this woman of east Asian appearance with a far younger guy who looked like he was part European, part Asian. She had the bag, camera and everything, and was acting like she knew she was in charge. The also seemed to have a bit of trouble walking straight. All in all, they gave off a pretty weird vibe. I really hope it was a cougar thing, because if he was a family member, they were acting downright creepy.

I’m having serious doubts about my ability to survive the rest of the month in Hong Kong. The infamous heat and humidity haven’t caused me problems – that doesn’t seem much worse than Sydney in summer. It doesn’t seem to rain too heavily for too long at a time, so that aspect isn’t really any worse than Melbourne. I read online that Sheung Wan smells like fish, but in reality there are just a few shops selling dried fish – not very smelly, and not the whole suburb by any means. When I arrived on a Saturday, Sheung Wan was blanketed in the smog that sometimes blows across from the mainland. People say it can be hard to tell the difference between mist and pollution, but I know the smell of coal furnace exhaust and this was it. I really wasn’t looking forward to breathing this every day. It would just about rule out any chance of getting exercise by walking to our from work, as it would mean that what’s supposed to be good for my heart would just end up being bad for my lungs. Fortunately that cleared up when a storm blew in on the following Monday afternoon and it hasn’t come back yet (fingers crossed); unfortunately it proved to be the least of my issues.

There’s this awesome laksa place on Hunter Street in the city, or at least everyone tells me it’s awesome, so I really want to try it. So I walked to Hunter Street last Sunday, keen to try get my Malaysian fix, but when I got there at half past one the place was closed and showed no signs of having been open at all that day. I looked carefully around the door and didn’t see opening hours posted anywhere. At least I got my walk in the sun, I now know they’re not open on Sundays, and I didn’t get a half-arsed weekend effort that isn’t representative of their weekday performance as happens at some eateries. I’ll try again on a Saturday, but failing that, it might have to wait for a day off. Is “laksa craving” as a valid medical condition for a sick leave form?

So having failed to get my laksa fix, I decided to finally have lunch at Tiger Bakers. Just walking in, the place felt far too hipster for me. The guy behind the bar was wearing a singlet, with his facial hair trimmed to look like five days’ growth, and his hair that says “I put a lot of effort into trying to look like I just rolled out of bed”. Oh yes, and it’s a bar – it’s so edgy, serving primarily as a coffee shop and restaurant, but in the form of a bar. The atmosphere is a bit of a let-down, too: if you sit well inside, it’s a bit stuffy and oppressive, but if you sit somewhere with fresh air and sunlight, you’ve got people smoking at that legally-just-outside counter messing with your ability to smell the food and coffee.

I got the barbecue lamb sandwich, and it tried pretty hard with crusty “Turkish-style” bread, lots of fancy salad leaves, tender spiced lamb, hummus and tzatziki. Although the hummus taste a bit flat, the everything else in the sandwich was done pretty well. The thing that ruined it was the chips they served with it. They were over-seasoned with that strong, artificial-tasting, MSG-loaded stuff. It conflicted terribly with the wholesome flavours of the sandwich, and it was the flavour that stuck with me after I left. All in all it was a disappointment, especially considering the good things I’ve heard about the place.